Home
Security Hardening
DISA STIG Cisco ASA FW V1R1

DISA STIG Cisco ASA FW V1R1

CASA-FW-000040 – The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred. – Log Parameters
Details Without establishing what type of event occurred, it would be difficult to establish, correlate, and investigate the events leading...
CASA-FW-000050 – The Cisco ASA must be configured to generate traffic log entries containing information to establish when (date and time) the events occurred.
Details Without establishing when events occurred, it is impossible to establish, correlate, and investigate the events leading up to an...
CASA-FW-000090 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – Buffer Enabled
Details It is critical that when the network element is at risk of failing to process traffic logs as required,...
CASA-FW-000090 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – Queue
Details It is critical that when the network element is at risk of failing to process traffic logs as required,...
CASA-FW-000100 – The Cisco ASA must be configured to use TCP when sending log records to the central audit server. – Logging Host
Details If the default UDP protocol is used for communication between the hosts and devices to the Central Log Server,...
CASA-FW-000100 – The Cisco ASA must be configured to use TCP when sending log records to the central audit server. – Logging Permit-hostdown
Details If the default UDP protocol is used for communication between the hosts and devices to the Central Log Server,...
CASA-FW-000130 – The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture. – HTTP
Details Network devices are capable of providing a wide variety of functions (capabilities or processes) and services. Some of these...
CASA-FW-000130 – The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture. – Telnet
Details Network devices are capable of providing a wide variety of functions (capabilities or processes) and services. Some of these...
CASA-FW-000150 – The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.
Details A firewall experiencing a DoS attack will not be able to handle production traffic load. The high utilization and...
CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – ACL
Details When the production network is managed in-band, the management network could be housed at a NOC that is located...

Prev Next

DISA STIG Cisco ASA FW V1R1

CASA-FW-000040 – The Cisco ASA must be configured to generate traffic log entries containing information to establish what type of events occurred. – Log Parameters

CASA-FW-000050 – The Cisco ASA must be configured to generate traffic log entries containing information to establish when (date and time) the events occurred.

CASA-FW-000090 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – Buffer Enabled

CASA-FW-000090 – The Cisco ASA must be configured to queue log records locally in the event that the central audit server is down or not reachable. – Queue

CASA-FW-000100 – The Cisco ASA must be configured to use TCP when sending log records to the central audit server. – Logging Host

CASA-FW-000100 – The Cisco ASA must be configured to use TCP when sending log records to the central audit server. – Logging Permit-hostdown

CASA-FW-000130 – The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture. – HTTP

CASA-FW-000130 – The Cisco ASA must be configured to disable or remove unnecessary network services and functions that are not used as part of its role in the architecture. – Telnet

CASA-FW-000150 – The Cisco ASA must be configured to enable threat detection to mitigate risks of denial-of-service (DoS) attacks.

CASA-FW-000260 – The Cisco ASA must be configured to forward management traffic to the Network Operations Center (NOC) via an IPsec tunnel. – ACL